More than five million images of faces have been collected without the consent or even knowledge of shoppers at Cadillac Fairview-owned malls across the country, according to Canada's privacy commissioner. 

The Privacy Commissioners of Canada, Alberta and B.C. announced in a joint statement on Thursday morning that they had concluded an investigation into the major mall operator's alleged use of facial recognition cameras inside information kiosks.

The privacy watchdogs concluded that CF had indeed "embedded cameras inside their digital information kiosks at 12 shopping malls across Canada and used facial recognition technology without their customers' knowledge or consent."

A list of malls in which the cameras were used includes Toronto's Eaton Centre, Sherway Gardens and Fairview Mall. 

WHOA. Canada's Privacy Commissioner says Cadillac Fairview, which runs malls like Toronto's Eaton Centre, collected and stored 5 million digital images of people, on a decommissioned server, "for no apparent purpose and with no justification." #CDNPOLI https://t.co/0cLkAPPNw6

— Lucas Meyer (@meyer_lucas) October 29, 2020

According to the privacy commissioner's report, CF had new "Anonymous Video Analytics (AVA)" technology was installed into wayfinding directories at all three GTA malls (and others in Quebec, B.C., Alberta and Manitoba) sometime in December of 2017.

Cadillac Fairview Corporation Limited told investigators that the technology was enabled between May and July of 2018 as part of a pilot project.

It is of note that said "pilot project" wrapped at the end of July, right after a series of news articles highlighted CF's shady practice of capturing biometric data from customers without consent through tiny, inconspicuous cameras.

The company, one of North America's largest commercial real estate operators, promised in August of 2018 that it had suspended the use of these kiosk cameras at malls in Calgary, but only after the provincial and federal privacy investigations were launched.

CF has removed the cameras from all of its digital directory kiosks as a result of the privacy investigation, and is said to have deleted the data it collected, save for what's "required for potential litigation purposes."

"This includes the 5 million biometric representations of individual shoppers' faces, which it had retained for no discernable reason," wrote the team of privacy commissioners in their release.

Wow.

Federal and Alberta privacy commissioners says Cadillac Fairview- which operates 12 malls across Canada (including Chinook Centre and Market Mall in Calgary) - embedded cameras in kiosks to gather customers' biometric data. #yyc #yyccc #yeg #yegcc pic.twitter.com/hBP3leIlnF

— Courtney Theriault (@cspotweet) October 29, 2020

CF, for its part, argued that it was only collecting the data to analyze ages and genders of shoppers, not to identify individuals. It also tried to say that it had warned shoppers by placing small decals on mall entry doors — a measure that officials deemed insufficient.

"Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis," said federal Privacy Commissioner Daniel Therrien in a statement.

"The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity."

While the collection and storage of customer data was found to be problematic, the commissioners are perhaps even warier of how CF did it — in near-total secrecy.

"The three privacy commissioners have recommended that if Cadillac Fairview were to use such technology in the future, it should take steps to obtain express, meaningful consent, before capturing and analyzing the biometric facial images of shoppers," reads the release.

"The Commissioners remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future."